Blizzard's vulnerability footprint centers on its gaming and authentication platforms, including Battle.net, Overwatch, and Warcraft 3: The Frozen Throne, with observed disclosures clustering around concurrency and synchronization issues, code injection, permission handling, and search-path control. The compact profile reflects the vendor's focus on multiplayer gaming and client-side software delivery rather than broad enterprise infrastructure; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Blizzard over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-4768HIGH Unspecified vulnerability in the JASS script interpreter in Warcraft III: The Frozen Throne 1.24b and earlier allows user-assisted remote attackers to execute arbitrary code via a | Apr 20, 2010 | 9.3 | 25 | NO | NO |
CVE-2025-27997HIGH An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData directory. | May 21, 2025 | 8.4 | 24 | NO | NO |
CVE-2020-27383HIGH Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file | Jun 9, 2021 | 7.8 | 22 | NO | NO |
CVE-2017-14748MEDIUM Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for other users) by leaving a competitive ma | Sep 26, 2017 | 5.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Blizzard.
Media articles that mention a CVE ID that affects a product developed by Blizzard — matched by CVE ID, not by vendor name.